CVE-2026-77812 describes a vulnerability in DJI drones where DUML protocol messages are transmitted over BLE without encryption. During normal operation, including Wi-Fi connection attempts or QuickTransfer mode, the DJI Fly app exchanges Wi-Fi credentials and a session UUID in cleartext. An attacker passively sniffing BLE traffic within range can recover these credentials and the UUID, enabling them to join the drone's Wi-Fi network, interact with exposed services, and replay the UUID to bypass device confirmation. The credentials remain valid indefinitely unless manually reset. Affected models include DJI Neo, Neo 2, Flip, Air 3, Air 3S, Avata 2, Avata 360, Mavic 3 variants, Mini 2, Mini 3 variants, Mini 4 Pro, and Mini 5 Pro with firmware versions prior to specified thresholds. No patch or official remediation level is provided in the data, but a firmware update from DJI is required to fix the issue.

An attacker within BLE range can passively obtain Wi-Fi credentials and a trusted session UUID from the drone, allowing unauthorized access to the drone's internal Wi-Fi network and services. This compromises network confidentiality and authentication mechanisms, enabling the attacker to decrypt Wi-Fi traffic and bypass physical confirmation of new device connections. The vulnerability persists indefinitely until Wi-Fi settings are manually reset or a firmware update is applied.

Remediation requires a firmware update from DJI. There is no user-side mitigation that fully addresses this vulnerability without upgrading the drone firmware. Users should monitor DJI advisories for firmware updates addressing this issue and apply them promptly once available.